| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20161115185756.GL3142@twins.programming.kicks-ass.net>
Date: Tue, 15 Nov 2016 19:57:56 +0100
From: Peter Zijlstra <peterz@...radead.org>
To: Vince Weaver <vincent.weaver@...ne.edu>
Cc: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
Ingo Molnar <mingo@...hat.com>,
Arnaldo Carvalho de Melo <acme@...nel.org>,
"davej@...emonkey.org.uk" <davej@...emonkey.org.uk>,
"dvyukov@...gle.com" <dvyukov@...gle.com>,
Stephane Eranian <eranian@...il.com>, jpoimboe@...hat.com
Subject: Re: perf: fuzzer KASAN unwind_get_return_address
On Tue, Nov 15, 2016 at 12:43:56PM -0500, Vince Weaver wrote:
>
> Running on my haswell machine with the imc/uncore patch applied, the
> perf_fuzzer next tripped over this issue.
>
> [ 202.034495] BAD LUCK: lost 371 message(s) from NMI context!
> [ 202.034496] ==================================================================
> [ 202.048327] BUG: KASAN: stack-out-of-bounds in unwind_get_return_address+0x35/0x80 at addr ffff8800cff0bd90
> [ 202.058826] Read of size 8 by task perf_fuzzer/16254
> [ 202.064186] page:ffffea00033fc2c0 count:1 mapcount:0 mapping: (null) index:0x0^Ac
> [ 202.073068] flags: 0x1ffff8000000400(reserved)
> [ 202.077885] page dumped because: kasan: bad access detected
> [ 202.083880] CPU: 4 PID: 16254 Comm: perf_fuzzer Not tainted 4.9.0-rc5+ #5
> [ 202.091204] Hardware name: LENOVO 10AM000AUS/SHARKBAY, BIOS FBKT72AUS 01/26/2014
> [ 202.099181] ffff8800cff0b1d8^Ac ffffffff816bb796^Ac ffff8800cff0b270^Ac ffff8800cff0bd90^Ac
> [ 202.107896] ffff8800cff0b260^Ac ffffffff812fbe95^Ac 00007ffc9d1ab480^Ac 0000000000000000^Ac
> [ 202.116638] ffffffff8125117d^Ac 0000000000000092^Ac 0000000000000000^Ac ffff8800cff0b7c0^Ac
> [ 202.125339] Call Trace:
> [ 202.127994] <NMI> [<ffffffff816bb796>] dump_stack+0x63/0x8d
> [ 202.134184] [<ffffffff812fbe95>] kasan_report_error+0x495/0x4c0
> [ 202.140680] [<ffffffff8125117d>] ? perf_output_begin+0x28d/0x4c0
> [ 202.147228] [<ffffffff812fc319>] kasan_report+0x39/0x40
> [ 202.152987] [<ffffffff81095ce5>] ? unwind_get_return_address+0x35/0x80
> [ 202.160094] [<ffffffff812fa8fe>] __asan_load8+0x5e/0x70
> [ 202.165859] [<ffffffff81095ce5>] unwind_get_return_address+0x35/0x80
Josh, any ideas?
> [ 202.172817] [<ffffffff8100b08d>] perf_callchain_kernel+0x22d/0x270
> [ 202.179590] [<ffffffff812fa7c4>] ? __asan_load4+0x24/0x80
> [ 202.185548] [<ffffffff8100ae60>] ? arch_perf_update_userpage+0x130/0x130
> [ 202.192849] [<ffffffff81252aaa>] get_perf_callchain+0x24a/0x3e0
> [ 202.199339] [<ffffffff81252860>] ? put_callchain_buffers+0x50/0x50
> [ 202.206092] [<ffffffff81095b17>] ? perf_get_regs_user+0x327/0x380
> [ 202.212751] [<ffffffff81135fd0>] ? lock_release+0x30/0x540
> [ 202.218803] [<ffffffff81252d05>] perf_callchain+0xc5/0xe0
> [ 202.224767] [<ffffffff812fa7c4>] ? __asan_load4+0x24/0x80
> [ 202.230696] [<ffffffff8124dbf9>] perf_prepare_sample+0x489/0x630
> [ 202.237275] [<ffffffff81135fd0>] ? lock_release+0x30/0x540
> [ 202.243266] [<ffffffff8124de9c>] ? perf_event_output_forward+0xfc/0x130
> [ 202.250472] [<ffffffff8124dda0>] ? perf_prepare_sample+0x630/0x630
> [ 202.257251] [<ffffffff8124e0ae>] perf_event_output+0xae/0x130
> [ 202.263564] [<ffffffff8124e000>] ? perf_event_output_backward+0x130/0x130
> [ 202.270964] [<ffffffff8124e000>] ? perf_event_output_backward+0x130/0x130
> [ 202.278373] [<ffffffff81247cc2>] ? perf_event_update_userpage+0x212/0x2b0
> [ 202.285772] [<ffffffff81247ab0>] ? perf_event_task_disable+0xc0/0xc0
> [ 202.292744] [<ffffffff812fac4f>] ? __asan_loadN+0xf/0x20
> [ 202.298581] [<ffffffff8101757d>] ? setup_pebs_sample_data+0x68d/0x830
> [ 202.305622] [<ffffffff81017a91>] __intel_pmu_pebs_event+0x221/0x3a0
> [ 202.312469] [<ffffffff81135e4d>] ? lock_acquire+0x3d/0x190
> [ 202.318523] [<ffffffff81017870>] ? pebs_update_state+0x150/0x150
> [ 202.325060] [<ffffffff8104c6ec>] ? get_stack_info+0x3c/0x150
> [ 202.331259] [<ffffffff810106b7>] ? __intel_pmu_enable_all+0x77/0xf0
> [ 202.338128] [<ffffffff812fa7c4>] ? __asan_load4+0x24/0x80
> [ 202.344059] [<ffffffff81018b50>] ? intel_pmu_disable_bts+0x60/0x60
> [ 202.350823] [<ffffffff812fa7c4>] ? __asan_load4+0x24/0x80
> [ 202.356740] [<ffffffff81252d05>] ? perf_callchain+0xc5/0xe0
> [ 202.362855] [<ffffffff81135fd0>] ? lock_release+0x30/0x540
> [ 202.368855] [<ffffffff8124dc31>] ? perf_prepare_sample+0x4c1/0x630
> [ 202.375619] [<ffffffff8124de84>] ? perf_event_output_forward+0xe4/0x130
> [ 202.382849] [<ffffffff81017ffc>] intel_pmu_drain_pebs_nhm+0x3ec/0x530
> [ 202.389899] [<ffffffff81017c10>] ? __intel_pmu_pebs_event+0x3a0/0x3a0
> [ 202.396959] [<ffffffff81247caa>] ? perf_event_update_userpage+0x1fa/0x2b0
> [ 202.406800] [<ffffffff81247cc2>] ? perf_event_update_userpage+0x212/0x2b0
> [ 202.416486] [<ffffffff81247ab0>] ? perf_event_task_disable+0xc0/0xc0
> [ 202.425720] [<ffffffff8101a832>] ? intel_pmu_lbr_read+0x32/0x790
> [ 202.434566] [<ffffffff8123ba26>] ? __perf_event_overflow+0x116/0x280
> [ 202.443735] [<ffffffff810144d8>] ? intel_bts_interrupt+0x88/0x1b0
> [ 202.452538] [<ffffffff81012c7e>] intel_pmu_handle_irq+0x3ae/0x690
> [ 202.461407] [<ffffffff810128d0>] ? intel_pmu_save_and_restart+0x80/0x80
> [ 202.470877] [<ffffffff81135fd0>] ? lock_release+0x30/0x540
> [ 202.479131] [<ffffffff81088eeb>] ? native_apic_msr_write+0x2b/0x30
> [ 202.488181] [<ffffffff8108899c>] ? x2apic_send_IPI_self+0x3c/0x50
> [ 202.497066] [<ffffffff81055d72>] ? native_sched_clock+0x62/0x140
> [ 202.505919] [<ffffffff810081fd>] perf_event_nmi_handler+0x2d/0x50
> [ 202.514832] [<ffffffff8104da91>] nmi_handle+0xb1/0x1d0
> [ 202.522697] [<ffffffff8104d9e5>] ? nmi_handle+0x5/0x1d0
> [ 202.530610] [<ffffffff8104e185>] default_do_nmi+0xe5/0x140
> [ 202.538765] [<ffffffff8104e332>] do_nmi+0x152/0x1b0
> [ 202.546254] [<ffffffff81b8f171>] end_repeat_nmi+0x1a/0x1e
> [ 202.554257] [<ffffffff810106b7>] ? __intel_pmu_enable_all+0x77/0xf0
> [ 202.563167] [<ffffffff812475eb>] ? perf_event_task_tick+0x48b/0x5f0
> [ 202.572060] [<ffffffff812475eb>] ? perf_event_task_tick+0x48b/0x5f0
> [ 202.580864] [<ffffffff812475eb>] ? perf_event_task_tick+0x48b/0x5f0
> [ 202.589703] <EOE> <IRQ> [<ffffffff81101571>] scheduler_tick+0xb1/0x150
> [ 202.598985] [<ffffffff8116e7e7>] update_process_times+0x47/0x60
> [ 202.607433] [<ffffffff81185e53>] tick_sched_handle.isra.14+0x33/0x80
> [ 202.616314] [<ffffffff811869cb>] tick_sched_timer+0x4b/0x90
> [ 202.624322] [<ffffffff8116fbfe>] __hrtimer_run_queues+0x21e/0x540
> [ 202.632864] [<ffffffff81186980>] ? tick_sched_do_timer+0x50/0x50
> [ 202.641337] [<ffffffff8116f9e0>] ? retrigger_next_event+0xa0/0xa0
> [ 202.649947] [<ffffffff8117b8f6>] ? ktime_get_update_offsets_now+0xe6/0x190
> [ 202.659411] [<ffffffff811707f0>] ? hrtimer_interrupt+0xb0/0x220
> [ 202.667864] [<ffffffff8117082f>] hrtimer_interrupt+0xef/0x220
> [ 202.676069] [<ffffffff8123b020>] ? perf_cgroup_attach+0xb0/0xb0
> [ 202.684444] [<ffffffff8107ec2f>] local_apic_timer_interrupt+0x4f/0x80
> [ 202.693422] [<ffffffff81b903d7>] smp_apic_timer_interrupt+0x57/0x70
> [ 202.702203] [<ffffffff81b8f6a2>] apic_timer_interrupt+0x82/0x90
> [ 202.710591] <EOI> [<ffffffff8123b020>] ? perf_cgroup_attach+0xb0/0xb0
> [ 202.719609] [<ffffffff8118dc3a>] ? smp_call_function_single+0x14a/0x1b0
> [ 202.728811] [<ffffffff8118dc30>] ? smp_call_function_single+0x140/0x1b0
> [ 202.738039] [<ffffffff8118daf0>] ? generic_exec_single+0x170/0x170
> [ 202.746727] [<ffffffff8123b020>] ? perf_cgroup_attach+0xb0/0xb0
> [ 202.755181] [<ffffffff81238e48>] event_function_call+0x268/0x270
> [ 202.763687] [<ffffffff812426d0>] ? task_ctx_sched_out+0x60/0x60
> [ 202.772057] [<ffffffff81238be0>] ? task_function_call+0xc0/0xc0
> [ 202.780404] [<ffffffff812426d0>] ? task_ctx_sched_out+0x60/0x60
> [ 202.788768] [<ffffffff81238e79>] ? _perf_event_disable+0x29/0x70
> [ 202.797258] [<ffffffff812383d0>] ? update_group_times+0x50/0x50
> [ 202.805667] [<ffffffff81238e97>] ? _perf_event_disable+0x47/0x70
> [ 202.814188] [<ffffffff8113a4d7>] ? do_raw_spin_unlock+0x97/0x130
> [ 202.822733] [<ffffffff81238e50>] ? event_function_call+0x270/0x270
> [ 202.831462] [<ffffffff81238ea8>] _perf_event_disable+0x58/0x70
> [ 202.839778] [<ffffffff812386a3>] perf_event_for_each_child+0x53/0xd0
> [ 202.848576] [<ffffffff81247a51>] perf_event_task_disable+0x61/0xc0
> [ 202.857303] [<ffffffff810daee2>] SyS_prctl+0x3f2/0x690
> [ 202.864853] [<ffffffff810daaf0>] ? SyS_umask+0x40/0x40
> [ 202.872375] [<ffffffff81136c6a>] ? lockdep_sys_exit+0x1a/0xa0
> [ 202.880517] [<ffffffff81004016>] ? lockdep_sys_exit_thunk+0x16/0x30
> [ 202.889310] [<ffffffff81b8dabb>] entry_SYSCALL_64_fastpath+0x1e/0xb2
> [ 202.898177] Memory state around the buggy address:
> [ 202.905288] ffff8800cff0bc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 202.915044] ffff8800cff0bd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 202.924697] >ffff8800cff0bd80: f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00
> [ 202.934420] ^
> [ 202.940352] ffff8800cff0be00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 202.950141] ffff8800cff0be80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 202.959835] ==================================================================
>
Powered by blists - more mailing lists